# Direct-apply gap inventory (RPF-WP-0043-T05)

Inventory date: 2026-09-22. Source: `Makefile` on `main` at `8a7ebce`.
Nothing here changes a target's behaviour.

## Declaration

Under the Kubernetes change gate (`the-custodian/docs/kubernetes-change-gate-decision.md`),
a platform object without a readiness state defaults to the production tier,
and the production row is `CONSTRUCT` through git and ArgoCD. The targets
below change railiance01 directly (`kubectl apply`, `helm upgrade`, or the
OpenBao API). Their evidence is `target-audited` only. **They do not conform
to the production row.** Until the founder rules on each group, every run is
`ADMINISTER @ realm:kubernetes/railiance01`, `activation=APPROVED`, and is
recorded as a production-tier change.

ArgoCD Core has run on railiance01 since 2026-09-21. The evidence is
`docs/evidence/2026-09-22-argocd-railiance01-status.json`. A reconciled lane
therefore exists for Kubernetes objects. It does not exist for OpenBao API
state.

## Inventory and proposal

| Group | Targets | What they change | Proposal |
| --- | --- | --- | --- |
| A. CNPG clusters, backups, NetworkPolicies | `db-deploy`, `forgejo-db-deploy`, `apps-pg-deploy`, `apps-pg-backup-deploy`, `apps-pg-overflow-deploy`, `net-kingdom-pg-inter-hub-networkpolicy-deploy` | `helm/*.yaml` via `kubectl apply` | **Move to a reconciled lane.** Adopt one Application per database cell, one at a time, as in RPF-WP-0044. The first sync is manual with prune off, and CNPG `Cluster` needs an AppProject whitelist entry. `db-deploy` (gitea-db) may be retirement, not adoption: check first whether gitea-db still exists. |
| B. ClusterSecretStores | the `openbao-secretstore` Application (already adopted) plus stores patched by hand during recoveries (RPF-WP-0037, RPF-WP-0045) | `ClusterSecretStore` specs | **Move to reconciled.** Store auth blocks belong in `argocd/`-tracked manifests. A hand patch now counts as drift to reconcile back into git. |
| C. OpenBao package | `openbao-deploy`, `openbao-overlay-apply`, `openbao-public-listener-retract`, `openbao-public-listener-rollback` | Helm release and gateway overlay in `openbao` | **Move to reconciled, with rapp-openbao.** The package belongs to `rapp-openbao`, so its Application should come from there. The listener retract and rollback stay direct as attended break-glass under `APPROVED`. |
| D. OpenBao configuration | `openbao-configure-initial`, `-ssh`, `-external-secrets-*`, `-workload-kv-lanes`, `-credential-change-appliers`, `-token-grants`, `credential-change-applier-apply` | policies, roles and mounts over the OpenBao API | **Stay direct under `APPROVED`.** ArgoCD cannot reconcile API state. The controls are compare-before-write scripts, attended login and per-run evidence. A declarative reconciler is a separate decision. |
| E. ArgoCD bootstrap | `argocd-bootstrap-deploy`, `argocd-repo-apply` | AppProjects, root Application, repository Secret | **`argocd-bootstrap-deploy`: never against railiance01.** It renders the old root with automated prune and self-heal. Use `argocd/railiance01/bootstrap/` (RPF-WP-0044). Retire or guard the target when coulombcore is retired (RPF-WP-0044-T08). `argocd-repo-apply` stays direct under `APPROVED` because it carries SOPS-encrypted credentials. |
| F. Not Kubernetes | `forgejo-package-prune`, `backup`, `forgejo-backup` | Forgejo API, backup uploads | Outside the Kubernetes gate. Stays direct. |
| Fail-closed | `pg-deploy`, `valkey-deploy` | nothing (refuse) | No action. |

Read-only targets (`*-status`, `*-logs`, `*-dry-run`, `*-verify*`,
`assurance-*`) change nothing and are not in scope.

## Founder decision requested

Accept or amend the per-group proposal. Adopting groups A to C is later work.
It is not started by this inventory.